CVE-2026-35533

mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jdx:mise:*:*:*:*:*:rust:*:*

History

24 Jul 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) mise gestiona herramientas de desarrollo como node, python, cmake y terraform. Desde el 2026.2.18 hasta el 2026.4.5, mise carga la configuración de control de confianza de un archivo .mise.toml de proyecto local antes de que se ejecute la verificación de confianza. Un atacante que puede colocar un .mise.toml malicioso en un repositorio puede hacer que ese mismo archivo parezca de confianza y luego alcanzar directivas peligrosas como [env] _.source, templates, hooks o tasks.

17 Jun 2026, 10:40

Type	Values Removed	Values Added
References	~~() https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8 - Vendor Advisory, Exploit~~	() https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8 - Exploit, Vendor Advisory

15 Apr 2026, 20:33

Type	Values Removed	Values Added
References	~~() https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8 -~~	() https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8 - Vendor Advisory, Exploit
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:jdx:mise::::::rust::*
First Time		Jdx Jdx mise

07 Apr 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-07 21:17

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35533

Mitre link : CVE-2026-35533

CVE.ORG link : CVE-2026-35533

JSON object : View

Products Affected

jdx

mise

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2026-35533", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35533", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T14:31:30.713607Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jdx", "product": "mise", "versions": [{"status": "affected", "version": ">= 2026.2.18, <= 2026.4.5"}]}]}], "published": "2026-04-07T21:17:17.870", "references": [{"url": "https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks."}, {"lang": "es", "value": "mise gestiona herramientas de desarrollo como node, python, cmake y terraform. Desde el 2026.2.18 hasta el 2026.4.5, mise carga la configuraci\u00f3n de control de confianza de un archivo .mise.toml de proyecto local antes de que se ejecute la verificaci\u00f3n de confianza. Un atacante que puede colocar un .mise.toml malicioso en un repositorio puede hacer que ese mismo archivo parezca de confianza y luego alcanzar directivas peligrosas como [env] _.source, templates, hooks o tasks."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jdx:mise:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "83684D2B-20F5-44CA-878A-9ADA7ED888F0", "versionEndIncluding": "2026.4.5", "versionStartIncluding": "2026.2.18"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}